winkd.h File Reference

#include <rz_util.h>
#include <stdint.h>
#include "kd.h"

Go to the source code of this file.

Classes
struct	WindProc
struct	WindThread
struct	WindModule
struct	WindMap
struct	Profile
struct	_WindCtx
struct	_KdCtx
struct	_DmpCtx

Macros
#define	TARGET_BACKEND   0
#define	TARGET_PHYSICAL   1
#define	TARGET_KERNEL   2
#define	TARGET_VIRTUAL   3

Typedefs
typedef struct WindProc	WindProc
typedef struct WindThread	WindThread
typedef struct WindModule	WindModule
typedef struct WindMap	WindMap
typedef int	WindReadAt(RZ_NONNULL void *user, ut64 address, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, int count)
typedef int	WindWriteAt(RZ_NONNULL void *user, ut64 address, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, int count)
typedef struct _WindCtx	WindCtx
typedef struct _KdCtx	KdCtx
typedef struct _DmpCtx	DmpCtx

Enumerations
enum	{ K_PaeEnabled = 0x036 , K_PsActiveProcessHead = 0x050 , K_CmNtCSDVersion = 0x268 , K_OffsetKThreadApcProcess = 0x2a0 }
enum	{   E_ActiveProcessLinks , E_UniqueProcessId , E_Peb , E_ImageFileName ,   E_VadRoot , E_ThreadListHead , K_DirectoryTableBase , P_ImageBaseAddress ,   P_ProcessParameters , RZ_ImagePathName , ET_ApcProcess , ET_ThreadListEntry ,   ET_Win32StartAddress , ET_Cid , C_UniqueThread , O_Max }

Functions
static ut64	winkd_read_ptr_at (RZ_BORROW RZ_NONNULL WindCtx *ctx, RZ_BORROW RZ_NONNULL WindReadAt *read_at_func, ut64 at)
static void	winkd_ctx_fini (RZ_BORROW RZ_NONNULL WindCtx *ctx)
int	winkd_get_bits (RZ_BORROW RZ_NONNULL WindCtx *ctx)
int	winkd_get_sp (RZ_BORROW RZ_NONNULL WindCtx *ctx)
Profile *	winkd_get_profile (int bits, int build, int sp)
bool	winkd_va_to_pa (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut64 directory_table, ut64 va, RZ_BORROW RZ_NONNULL RZ_OUT ut64 *pa)
ut64	winkd_get_target_base (RZ_BORROW RZ_NONNULL WindCtx *ctx)
ut32	winkd_get_target (RZ_BORROW RZ_NONNULL WindCtx *ctx)
ut32	winkd_get_target_thread (RZ_BORROW RZ_NONNULL WindCtx *ctx)
bool	winkd_set_target (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut32 pid, ut32 tid)
WindProc *	winkd_get_process_at (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut64 address)
WindThread *	winkd_get_thread_at (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut64 address)
RzList *	winkd_list_process (RZ_BORROW RZ_NONNULL WindCtx *ctx)
RzList *	winkd_list_threads (RZ_BORROW RZ_NONNULL WindCtx *ctx)
void	winkd_windmodule_free (void *ptr)
RzList *	winkd_list_modules (RZ_BORROW RZ_NONNULL WindCtx *ctx)
RzList *	winkd_list_maps (RZ_BORROW RZ_NONNULL WindCtx *ctx)
int	winkd_read_at_uva (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut64 offset, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, int count)
int	winkd_write_at_uva (RZ_BORROW RZ_NONNULL WindCtx *ctx, ut64 offset, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, int count)
KdCtx *	winkd_kdctx_new (RZ_BORROW RZ_NONNULL io_desc_t *desc)
void	winkd_kdctx_free (RZ_OWN KdCtx **ctx)
int	winkd_get_cpus (RZ_BORROW RZ_NONNULL KdCtx *ctx)
bool	winkd_set_cpu (RZ_BORROW RZ_NONNULL KdCtx *ctx, int cpu)
int	winkd_get_cpu (RZ_BORROW RZ_NONNULL KdCtx *ctx)
int	winkd_wait_packet (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut32 type, RZ_NULLABLE RZ_OUT kd_packet_t **p)
int	winkd_sync (RZ_BORROW RZ_NONNULL KdCtx *ctx)
bool	winkd_read_ver (RZ_BORROW RZ_NONNULL KdCtx *ctx)
int	winkd_continue (RZ_BORROW RZ_NONNULL KdCtx *ctx, bool handled)
bool	winkd_write_reg (RZ_BORROW RZ_NONNULL KdCtx *ctx, ut32 flags, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, int size)
int	winkd_read_reg (RZ_BORROW RZ_NONNULL KdCtx *ctx, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, int size)
int	winkd_query_mem (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 addr, int *address_space, int *flags)
int	winkd_bkpt (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 addr, const int set, const int hw, RZ_BORROW RZ_NONNULL int *handle)
int	winkd_read_at (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 offset, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, const int count)
int	winkd_read_at_phys (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 offset, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, const int count)
int	winkd_write_at (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 offset, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, const int count)
int	winkd_write_at_phys (RZ_BORROW RZ_NONNULL KdCtx *ctx, const ut64 offset, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, const int count)
void	winkd_break (void *ctx)
bool	winkd_lock_enter (RZ_BORROW RZ_NONNULL KdCtx *ctx)
bool	winkd_lock_leave (RZ_BORROW RZ_NONNULL KdCtx *ctx)

Macro Definition Documentation

TARGET_BACKEND

#define TARGET_BACKEND   0

Definition at line 113 of file winkd.h.

TARGET_KERNEL

#define TARGET_KERNEL   2

Definition at line 115 of file winkd.h.

TARGET_PHYSICAL

#define TARGET_PHYSICAL   1

Definition at line 114 of file winkd.h.

TARGET_VIRTUAL

#define TARGET_VIRTUAL   3

Definition at line 116 of file winkd.h.

Typedef Documentation

DmpCtx

typedef struct _DmpCtx DmpCtx

KdCtx

typedef struct _KdCtx KdCtx

WindCtx

typedef struct _WindCtx WindCtx

WindMap

typedef struct WindMap WindMap

WindModule

typedef struct WindModule WindModule

WindProc

typedef struct WindProc WindProc

WindReadAt

typedef int WindReadAt(RZ_NONNULL void *user, ut64 address, RZ_BORROW RZ_NONNULL RZ_OUT ut8 *buf, int count)

Definition at line 76 of file winkd.h.

WindThread

typedef struct WindThread WindThread

WindWriteAt

typedef int WindWriteAt(RZ_NONNULL void *user, ut64 address, RZ_BORROW RZ_NONNULL RZ_IN const ut8 *buf, int count)

Definition at line 77 of file winkd.h.

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
K_PaeEnabled
K_PsActiveProcessHead
K_CmNtCSDVersion
K_OffsetKThreadApcProcess

Definition at line 42 of file winkd.h.

     {
    K_PaeEnabled = 0x036,
    K_PsActiveProcessHead = 0x050,
    K_CmNtCSDVersion = 0x268,
    K_OffsetKThreadApcProcess = 0x2a0
};

anonymous enum

anonymous enum

Enumerator
E_ActiveProcessLinks
E_UniqueProcessId
E_Peb
E_ImageFileName
E_VadRoot
E_ThreadListHead
K_DirectoryTableBase
P_ImageBaseAddress
P_ProcessParameters
RZ_ImagePathName
ET_ApcProcess
ET_ThreadListEntry
ET_Win32StartAddress
ET_Cid
C_UniqueThread
O_Max

Definition at line 49 of file winkd.h.

     {
    E_ActiveProcessLinks, // EPROCESS
    E_UniqueProcessId, // EPROCESS
    E_Peb, // EPROCESS
    E_ImageFileName, // EPROCESS
    E_VadRoot, // EPROCESS
    E_ThreadListHead, // EPROCESS
    K_DirectoryTableBase, // KPROCESS
    P_ImageBaseAddress, // PEB
    P_ProcessParameters, // PEB
    RZ_ImagePathName, // RTL_USER_PROCESS_PARAMETERS
    ET_ApcProcess, // ETHREAD
    ET_ThreadListEntry, // ETHREAD
    ET_Win32StartAddress, // ETHREAD
    ET_Cid, // ETHREAD
    C_UniqueThread, // CLIENT_ID
    O_Max,
};

Function Documentation

winkd_bkpt()

int winkd_bkpt	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	addr,
		const int	set,
		const int	hw,
		RZ_BORROW RZ_NONNULL int *	handle
	)

Definition at line 1312 of file winkd.c.

                                                                                                                                {
    kd_req_t req = { 0 };
    kd_packet_t *pkt;
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
 
    req.req = set ? DbgKdWriteBreakPointApi : DbgKdRestoreBreakPointApi;
    req.cpu = ctx->cpu;
 
    if (set) {
        req.rz_set_bp.addr = addr;
    } else {
        req.rz_del_bp.handle = *handle;
    }
 
    if (!winkd_send_state_manipulate_req(ctx, &req, NULL, 0, &pkt)) {
        return 0;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
 
    if (rr->ret) {
        free(pkt);
        return 0;
    }
    *handle = rr->rz_set_bp.handle;
    free(pkt);
    return 1;
}

References addr, DbgKdRestoreBreakPointApi, DbgKdWriteBreakPointApi, free(), handle, NULL, PKT_REQ, req, and winkd_send_state_manipulate_req().

Referenced by rz_debug_winkd_breakpoint().

winkd_break()

void winkd_break

(

void *

ctx

)

Definition at line 1442 of file winkd.c.

                            {
    // This command shouldn't be wrapped by locks since it can always be sent and we don't
    // want break queued up after another background task
    KdCtx *ctx = (KdCtx *)arg;
    ctx->breaked = true;
    (void)iob_write(ctx->desc, (const ut8 *)"b", 1);
}

References iob_write().

Referenced by winkd_lock_enter().

winkd_continue()

int winkd_continue	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		bool	handled
	)

Definition at line 1141 of file winkd.c.

                                                                  {
    kd_req_t req = { 0 };
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
    req.req = DbgKdContinueApi;
    req.cpu = ctx->cpu;
    req.rz_cont.reason = handled ? 0x10001 : 0x80010001;
    // The meaning of 0x400 is unknown, but Windows doesn't
    // behave like suggested by ReactOS source
    req.rz_cont.tf = 0x400;
 
    if (!winkd_lock_enter(ctx)) {
        return KD_E_TIMEOUT;
    }
    int ret;
    do {
        ret = kd_send_data_packet(ctx->desc, KD_PACKET_TYPE_STATE_MANIPULATE,
            ctx->seq_id, (ut8 *)&req, sizeof(kd_req_t), NULL, 0);
        if (ret != KD_E_OK) {
            break;
        }
        ret = winkd_wait_packet(ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
        if (ret == KD_E_OK) {
            break;
        }
    } while (ret == KD_E_MALFORMED);
 
    rz_list_free(ctx->plist_cache);
    ctx->plist_cache = NULL;
    rz_list_free(ctx->tlist_cache);
    ctx->tlist_cache = NULL;
    ctx->context_cache_valid = false;
    winkd_lock_leave(ctx);
    return ret == KD_E_OK;
}

References DbgKdContinueApi, KD_E_MALFORMED, KD_E_OK, KD_E_TIMEOUT, KD_PACKET_TYPE_ACKNOWLEDGE, KD_PACKET_TYPE_STATE_MANIPULATE, kd_send_data_packet(), NULL, req, rz_list_free(), winkd_lock_enter(), winkd_lock_leave(), and winkd_wait_packet().

Referenced by rz_debug_winkd_continue().

winkd_ctx_fini()

static void winkd_ctx_fini ( RZ_BORROW RZ_NONNULL WindCtx *  ctx )

inlinestatic

Definition at line 141 of file winkd.h.

                                                                     {
    free(ctx->user);
    free(ctx->profile);
}

References free().

Referenced by dmp_close(), and winkd_kdctx_free().

winkd_get_bits()

int winkd_get_bits

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 80 of file winkd.c.

                                                      {
    return ctx->is_64bit ? RZ_SYS_BITS_64 : RZ_SYS_BITS_32;
}

References RZ_SYS_BITS_32, and RZ_SYS_BITS_64.

Referenced by rz_debug_winkd_attach().

winkd_get_cpu()

int winkd_get_cpu

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 99 of file winkd.c.

                                                   {
    if (!ctx) {
        return -1;
    }
    return ctx->cpu;
}

winkd_get_cpus()

int winkd_get_cpus

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 84 of file winkd.c.

                                                    {
    if (!ctx) {
        return -1;
    }
    return ctx->cpu_count;
}

winkd_get_process_at()

WindProc* winkd_get_process_at	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut64	address
	)

Definition at line 488 of file winkd.c.

                                                                                {
    ut8 type;
    if (!ctx->read_at_kernel_virtual(ctx->user, address, &type, 1)) {
        RZ_LOG_WARN("Failed to read DISPACHER_HEAD.Type at: 0x%" PFMT64x "\n", address);
        return NULL;
    }
    if ((type & 0x7f) != KOBJECT_PROCESS) {
        RZ_LOG_WARN("KOBJECT at 0x%" PFMT64x " is not a process.\n", address);
        return NULL;
    }
    WindProc *proc = RZ_NEW0(WindProc);
    if (!proc) {
        return NULL;
    }
    // Read the short name
    ctx->read_at_kernel_virtual(ctx->user, address + O_(E_ImageFileName), (ut8 *)proc->name, sizeof(proc->name));
    proc->name[sizeof(proc->name) - 1] = '\0';
    proc->eprocess = address;
    proc->vadroot = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, address + O_(E_VadRoot));
    proc->uniqueid = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, address + O_(E_UniqueProcessId));
    proc->peb = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, address + O_(E_Peb));
    proc->dir_base_table = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, address + O_(K_DirectoryTableBase));
    return proc;
}

References E_ImageFileName, E_Peb, E_UniqueProcessId, E_VadRoot, K_DirectoryTableBase, KOBJECT_PROCESS, Proc::name, NULL, O_, PFMT64x, proc, RZ_LOG_WARN, RZ_NEW0, type, and winkd_read_ptr_at().

Referenced by get_current_process_and_thread(), rz_debug_dmp_attach(), rz_debug_dmp_init(), and winkd_list_process().

winkd_get_profile()

Profile* winkd_get_profile	(	int	bits,
		int	build,
		int	sp
	)

Definition at line 58 of file winkd.c.

                                                        {
    int i;
    for (i = 0; p_table[i]; i++) {
        if (p_table[i]->build != build) {
            continue;
        }
        if (p_table[i]->sp != sp) {
            continue;
        }
        if (p_table[i]->bits != bits) {
            continue;
        }
        Profile *p = RZ_NEW0(Profile);
        if (!p) {
            return NULL;
        }
        *p = *p_table[i];
        return p;
    }
    return NULL;
}

References bits(), build(), i, NULL, p, p_table, RZ_NEW0, and sp.

Referenced by rz_debug_dmp_init(), and winkd_read_ver().

winkd_get_sp()

int winkd_get_sp

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 40 of file winkd.c.

                                                    {
    ut64 ptr = 0;
    // Grab the CmNtCSDVersion field to extract the Service Pack number
    if (!ctx->read_at_kernel_virtual(ctx->user, ctx->KdDebuggerDataBlock + K_CmNtCSDVersion, (ut8 *)&ptr, 8)) {
        RZ_LOG_DEBUG("Failed to read at %" PFMT64x "\n", ctx->KdDebuggerDataBlock + K_CmNtCSDVersion);
        return 0;
    }
    ut64 res;
    if (!ctx->read_at_kernel_virtual(ctx->user, ptr, (ut8 *)&res, 8)) {
        RZ_LOG_DEBUG("Failed to read at %" PFMT64x "\n", ptr);
        return 0;
    }
    if (res == UT64_MAX) {
        return 0;
    }
    return (res >> 8) & 0xff;
}

References K_CmNtCSDVersion, PFMT64x, RZ_LOG_DEBUG, ut64(), and UT64_MAX.

Referenced by rz_debug_dmp_init(), and winkd_read_ver().

winkd_get_target()

ut32 winkd_get_target

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 158 of file winkd.c.

                                                         {
    return ctx->target.uniqueid;
}

Referenced by __read(), __write(), and rz_debug_winkd_select().

winkd_get_target_base()

ut64 winkd_get_target_base

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 166 of file winkd.c.

                                                              {
    ut64 base = 0;
 
    if (!winkd_read_at_uva(ctx, ctx->target.peb + O_(P_ImageBaseAddress),
            (ut8 *)&base, 4 << ctx->is_64bit)) {
        return 0;
    }
 
    return base;
}

References O_, P_ImageBaseAddress, ut64(), and winkd_read_at_uva().

Referenced by rz_debug_winkd_select().

winkd_get_target_thread()

ut32 winkd_get_target_thread

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 162 of file winkd.c.

                                                                {
    return ctx->target_thread.uniqueid;
}

Referenced by rz_debug_winkd_select().

winkd_get_thread_at()

WindThread* winkd_get_thread_at	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut64	address
	)

Definition at line 739 of file winkd.c.

                                                                                 {
    int running_offset;
    if (ctx->profile->build < 9200) {
        running_offset = ctx->is_64bit ? 0x49 : 0x39;
    } else {
        running_offset = ctx->is_64bit ? 0x71 : 0x55;
    }
    ut8 type = 0;
    if (!ctx->read_at_kernel_virtual(ctx->user, address, &type, 1)) {
        RZ_LOG_WARN("Failed to read DISPACHER_HEAD.Type at: 0x%" PFMT64x "\n", address);
        return NULL;
    }
    if ((type & 0x7f) != KOBJECT_THREAD) {
        RZ_LOG_WARN("KOBJECT at 0x%" PFMT64x " is not a thread.\n", address);
        return NULL;
    }
    ut64 entrypoint = 0;
    if (!ctx->read_at_kernel_virtual(ctx->user, address + O_(ET_Win32StartAddress), (ut8 *)&entrypoint, 4 << ctx->is_64bit)) {
        RZ_LOG_WARN("Failed to read Win32StartAddress at: 0x%" PFMT64x "\n", address + O_(ET_Win32StartAddress));
        return NULL;
    }
    ut64 uniqueid = 0;
    if (!ctx->read_at_kernel_virtual(ctx->user, address + O_(ET_Cid) + O_(C_UniqueThread), (ut8 *)&uniqueid, 4 << ctx->is_64bit)) {
        RZ_LOG_WARN("Failed to read UniqueThread at: 0x%" PFMT64x "\n", address + O_(ET_Cid) + O_(C_UniqueThread));
        return NULL;
    }
    bool running = false;
    if (!ctx->read_at_kernel_virtual(ctx->user, address + running_offset, (ut8 *)&running, 1)) {
        RZ_LOG_WARN("Failed to read KTHREAD.Running at: 0x%" PFMT64x "\n", address + running_offset);
        return NULL;
    }
    WindThread *thread = calloc(1, sizeof(WindThread));
    if (!thread) {
        return NULL;
    }
    thread->uniqueid = uniqueid;
    thread->status = running ? 'r' : 's';
    thread->runnable = true;
    thread->ethread = address;
    thread->entrypoint = entrypoint;
    return thread;
}

References C_UniqueThread, calloc(), WindThread::entrypoint, ET_Cid, ET_Win32StartAddress, WindThread::ethread, KOBJECT_THREAD, NULL, O_, PFMT64x, WindThread::runnable, RZ_LOG_WARN, WindThread::status, type, WindThread::uniqueid, and ut64().

Referenced by get_current_process_and_thread(), rz_debug_dmp_attach(), rz_debug_dmp_init(), and winkd_list_threads().

winkd_kdctx_free()

void winkd_kdctx_free

(

RZ_OWN KdCtx **

ctx

)

Definition at line 187 of file winkd.c.

                                          {
    if (!ctx || !*ctx) {
        return;
    }
    rz_list_free((*ctx)->plist_cache);
    rz_list_free((*ctx)->tlist_cache);
    io_desc_t *desc = (*ctx)->desc;
    desc->iob->close(desc->fp);
    RZ_FREE(desc);
    rz_th_lock_free((*ctx)->dontmix);
    winkd_ctx_fini(&(*ctx)->windctx);
    free((*ctx)->kernel_module.name);
    RZ_FREE(*ctx);
}

References desc, free(), RZ_FREE, rz_list_free(), rz_th_lock_free(), and winkd_ctx_fini().

Referenced by __close().

winkd_kdctx_new()

KdCtx* winkd_kdctx_new

(

RZ_BORROW RZ_NONNULL io_desc_t *

desc

)

Definition at line 177 of file winkd.c.

                                                             {
    KdCtx *ctx = RZ_NEW0(KdCtx);
    if (!ctx) {
        return NULL;
    }
    ctx->dontmix = rz_th_lock_new(true);
    ctx->desc = desc;
    return ctx;
}

References desc, NULL, RZ_NEW0, and rz_th_lock_new().

Referenced by __open().

winkd_list_maps()

RzList* winkd_list_maps

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 476 of file winkd.c.

                                                           {
    if (!ctx->target.vadroot) {
        return NULL;
    }
    RzList *maps = rz_list_newf(free);
    if (!maps) {
        return NULL;
    }
    winkd_walk_vadtree(ctx, ctx->target.vadroot, UT64_MAX, maps);
    return maps;
}

References free(), maps(), NULL, rz_list_newf(), UT64_MAX, and winkd_walk_vadtree().

Referenced by rz_debug_dmp_maps(), and rz_debug_winkd_maps().

winkd_list_modules()

RzList* winkd_list_modules

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 625 of file winkd.c.

                                                              {
    RzList *ret = rz_list_newf(winkd_windmodule_free);
    if (!ret) {
        return NULL;
    }
    ut64 ptr, base;
    int list_entry_off = 0;
    const bool is_target_kernel = ctx->target.uniqueid <= 4;
    if (is_target_kernel) {
        if (!ctx->PsLoadedModuleList) {
            RZ_LOG_ERROR("No PsLoadedModuleList\n");
            return ret;
        }
        ptr = ctx->PsLoadedModuleList;
        base = ptr;
        if (!ctx->read_at_kernel_virtual(ctx->user, ptr, (ut8 *)&ptr, 4 << ctx->is_64bit)) {
            RZ_LOG_ERROR("PsLoadedModuleList not present in mappings\n");
        }
        if (ptr == base) {
            return ret;
        }
    } else {
        // Get kernel modules
        const ut32 saved_target = ctx->target.uniqueid;
        ctx->target.uniqueid = 0;
        RzList *kernel_modules = winkd_list_modules(ctx);
        ctx->target.uniqueid = saved_target;
 
        if (kernel_modules) {
            rz_list_join(ret, kernel_modules);
            rz_list_free(kernel_modules);
        }
 
        if (!ctx->target.peb) {
            RZ_LOG_ERROR("No PEB for target\n");
            return ret;
        }
 
        // Grab the _PEB_LDR_DATA from PEB
        ut64 ldroff = ctx->is_64bit ? 0x18 : 0xC;
        if (!winkd_read_at_uva(ctx, ctx->target.peb + ldroff, (ut8 *)&ptr, 4 << ctx->is_64bit)) {
            RZ_LOG_ERROR("PEB not present in target mappings\n");
            return ret;
        }
 
        RZ_LOG_DEBUG("_PEB_LDR_DATA : 0x%016" PFMT64x "\n", ptr);
 
        // LIST_ENTRY InMemoryOrderModuleList
        ut64 mlistoff = ctx->is_64bit ? 0x20 : 0x14;
 
        base = ptr + mlistoff;
 
        winkd_read_at_uva(ctx, base, (ut8 *)&ptr, 4 << ctx->is_64bit);
 
        // Offset of InMemoryOrderLinks inside _LDR_DATA_TABLE_ENTRY
        list_entry_off = (4 << ctx->is_64bit) * 2;
    }
 
    RZ_LOG_DEBUG("InMemoryOrderModuleList : 0x%016" PFMT64x "\n", ptr);
 
    const ut64 baseoff = ctx->is_64bit ? 0x30 : 0x18;
    const ut64 sizeoff = ctx->is_64bit ? 0x40 : 0x20;
    const ut64 nameoff = ctx->is_64bit ? 0x48 : 0x24;
    const ut64 timestampoff = is_target_kernel
        ? ctx->is_64bit ? 0x9c : 0x58
        : ctx->is_64bit ? 0x80
                : 0x44;
    do {
 
        ut64 next = 0;
        read_at_uva_or_kernel(ctx, ptr, (ut8 *)&next, 4 << ctx->is_64bit);
 
        RZ_LOG_DEBUG("_%sLDR_DATA_TABLE_ENTRY : 0x%016" PFMT64x "\n", is_target_kernel ? "K" : "", next);
        if (!next || next == UT64_MAX) {
            RZ_LOG_WARN("Corrupted InMemoryOrderModuleList found at: 0x%" PFMT64x "\n", ptr);
            break;
        }
 
        ptr -= list_entry_off;
 
        WindModule *mod = RZ_NEW0(WindModule);
        if (!mod) {
            break;
        }
        read_at_uva_or_kernel(ctx, ptr + baseoff, (ut8 *)&mod->addr, 4 << ctx->is_64bit);
        read_at_uva_or_kernel(ctx, ptr + sizeoff, (ut8 *)&mod->size, 4);
        read_at_uva_or_kernel(ctx, ptr + timestampoff, (ut8 *)&mod->timestamp, 4);
 
        ut16 length;
        read_at_uva_or_kernel(ctx, ptr + nameoff, (ut8 *)&length, sizeof(ut16));
 
        ut64 bufferaddr = 0;
        int align = ctx->is_64bit ? sizeof(ut64) : sizeof(ut32);
        read_at_uva_or_kernel(ctx, ptr + nameoff + align, (ut8 *)&bufferaddr, 4 << ctx->is_64bit);
 
        ut8 *unname = calloc((ut64)length + 2, 1);
        if (!unname) {
            break;
        }
        read_at_uva_or_kernel(ctx, bufferaddr, unname, length);
 
        mod->name = calloc((ut64)length + 1, 1);
        if (!mod->name) {
            break;
        }
        rz_str_utf16_to_utf8((ut8 *)mod->name, length + 1, unname, length + 2, true);
        free(unname);
        rz_list_add_sorted(ret, mod, map_comparator);
 
        ptr = next;
    } while (ptr != base);
    return ret;
}

References calloc(), free(), is_target_kernel(), length, map_comparator(), mod(), NULL, PFMT64x, read_at_uva_or_kernel(), rz_list_add_sorted(), rz_list_free(), rz_list_join(), rz_list_newf(), RZ_LOG_DEBUG, RZ_LOG_ERROR, RZ_LOG_WARN, RZ_NEW0, rz_str_utf16_to_utf8(), ut64(), UT64_MAX, winkd_read_at_uva(), and winkd_windmodule_free().

Referenced by dmp_get_modules(), rz_debug_dmp_init(), and rz_debug_winkd_modules().

winkd_list_process()

RzList* winkd_list_process

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 513 of file winkd.c.

                                                              {
    RzList *ret = NULL;
    bool current_process_found = false;
    // Grab the PsActiveProcessHead from _KDDEBUGGER_DATA64
    ctx->PsActiveProcessHead = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, ctx->KdDebuggerDataBlock + K_PsActiveProcessHead);
 
    // Walk the LIST_ENTRY
    ut64 ptr = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, ctx->PsActiveProcessHead);
 
    // Check for empty list
    if (ptr == 0 || ptr == UT64_MAX) {
        RZ_LOG_ERROR("NULL value at PsActiveProcessHead\n");
        if (ctx->target.eprocess) {
            ret = rz_list_newf(free);
            goto get_cur_process;
        }
        return NULL;
    }
    ret = rz_list_newf(free);
 
    do {
        ut64 next;
 
        // Read the ActiveProcessLinks entry
        next = winkd_read_ptr_at(ctx, ctx->read_at_kernel_virtual, ptr);
 
        if (!next || next == UT64_MAX) {
            RZ_LOG_WARN("Corrupted ActiveProcessLinks entry found at: 0x%" PFMT64x "\n", ptr);
            break;
        }
 
        // This points to the 'ActiveProcessLinks' list, adjust the ptr so that it point to the
        // EPROCESS base
        ptr -= O_(E_ActiveProcessLinks);
 
        WindProc *proc = winkd_get_process_at(ctx, ptr);
        if (proc) {
            if (proc->eprocess == ctx->target.eprocess) {
                current_process_found = true;
            }
            rz_list_append(ret, proc);
        }
        ptr = next;
    } while (ptr != ctx->PsActiveProcessHead);
get_cur_process:
    if (!current_process_found && ctx->target.eprocess) {
        WindProc *proc = winkd_get_process_at(ctx, ctx->target.eprocess);
        if (proc) {
            rz_list_append(ret, proc);
        }
    }
    return ret;
}

References E_ActiveProcessLinks, free(), K_PsActiveProcessHead, NULL, O_, PFMT64x, proc, rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_LOG_WARN, ut64(), UT64_MAX, winkd_get_process_at(), and winkd_read_ptr_at().

Referenced by rz_debug_dmp_pids(), rz_debug_winkd_pids(), and winkd_set_target().

winkd_list_threads()

RzList* winkd_list_threads

(

RZ_BORROW RZ_NONNULL WindCtx *

ctx

)

Definition at line 782 of file winkd.c.

                                                              {
    RzList *ret;
    ut64 ptr, base;
    bool current_thread_found = false;
    ptr = ctx->target.eprocess;
    if (!ptr) {
        RZ_LOG_ERROR("No _EPROCESS for target\n");
        if (ctx->target_thread.ethread) {
            ret = rz_list_newf(free);
            goto get_cur_thread;
        }
        return NULL;
    }
 
    // Grab the ThreadListHead from _EPROCESS
    ctx->read_at_kernel_virtual(ctx->user, ptr + O_(E_ThreadListHead), (ut8 *)&ptr, 4 << ctx->is_64bit);
    if (!ptr) {
        RZ_LOG_ERROR("No ThreadListHead for target\n");
        if (ctx->target_thread.ethread) {
            ret = rz_list_newf(free);
            goto get_cur_thread;
        }
        return NULL;
    }
 
    base = ptr;
 
    ret = rz_list_newf(free);
 
    do {
        ut64 next = 0;
 
        ctx->read_at_kernel_virtual(ctx->user, ptr, (ut8 *)&next, 4 << ctx->is_64bit);
        if (!next || next == UT64_MAX) {
            RZ_LOG_WARN("Corrupted ThreadListEntry found at: 0x%" PFMT64x "\n", ptr);
            break;
        }
        if (next == base) {
            break;
        }
 
        // Adjust the ptr so that it points to the ETHREAD base
        ptr -= O_(ET_ThreadListEntry);
 
        WindThread *thread = winkd_get_thread_at(ctx, ptr);
        if (thread) {
            if (thread->ethread == ctx->target_thread.ethread) {
                current_thread_found = true;
            }
            rz_list_append(ret, thread);
        }
        ptr = next;
    } while (true);
get_cur_thread:
    if (!current_thread_found && ctx->target_thread.ethread) {
        WindThread *thread = winkd_get_thread_at(ctx, ctx->target_thread.ethread);
        if (thread) {
            rz_list_append(ret, thread);
        }
    }
    return ret;
}

References E_ThreadListHead, ET_ThreadListEntry, WindThread::ethread, free(), NULL, O_, PFMT64x, rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_LOG_WARN, ut64(), UT64_MAX, and winkd_get_thread_at().

Referenced by rz_debug_dmp_threads(), rz_debug_winkd_threads(), and winkd_set_target().

winkd_lock_enter()

bool winkd_lock_enter

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 23 of file winkd.c.

                                                       {
    rz_cons_break_push(winkd_break, ctx);
    while (!rz_th_lock_tryenter(ctx->dontmix)) {
        if (rz_cons_is_breaked()) {
            rz_cons_break_pop();
            return false;
        }
    }
    return true;
}

References rz_cons_break_pop(), rz_cons_break_push(), rz_cons_is_breaked(), rz_th_lock_tryenter(), and winkd_break().

Referenced by do_io_reply(), rz_debug_winkd_wait(), winkd_continue(), winkd_send_state_manipulate_req(), and winkd_sync().

winkd_lock_leave()

bool winkd_lock_leave

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 34 of file winkd.c.

                                                       {
    rz_cons_break_pop();
    rz_th_lock_leave(ctx->dontmix);
    return true;
}

References rz_cons_break_pop(), and rz_th_lock_leave().

Referenced by do_io_reply(), rz_debug_winkd_wait(), winkd_continue(), winkd_send_state_manipulate_req(), and winkd_sync().

winkd_query_mem()

int winkd_query_mem	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	addr,
		int *	address_space,
		int *	flags
	)

Definition at line 1276 of file winkd.c.

                                                                                                      {
    kd_req_t req = { 0 };
    kd_packet_t *pkt;
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
 
    req.req = DbgKdQueryMemoryApi;
    req.cpu = ctx->cpu;
 
    req.rz_query_mem.addr = addr;
    req.rz_query_mem.address_space = 0; // Tells the kernel that 'addr' is a virtual address
 
    if (!winkd_send_state_manipulate_req(ctx, &req, NULL, 0, &pkt)) {
        return 0;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
 
    if (rr->ret) {
        free(pkt);
        return 0;
    }
 
    if (address_space) {
        *address_space = rr->rz_query_mem.address_space;
    }
    if (flags) {
        *flags = rr->rz_query_mem.flags;
    }
 
    free(pkt);
    return 1;
}

References addr, DbgKdQueryMemoryApi, flags, free(), NULL, PKT_REQ, req, and winkd_send_state_manipulate_req().

winkd_read_at()

int winkd_read_at	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_OUT ut8 *	buf,
		const int	count
	)

Definition at line 1377 of file winkd.c.

                                                                                                                             {
    if (!ctx || !ctx->desc || !ctx->syncd || count < 0) {
        return 0;
    }
    return read_at(ctx, DbgKdReadVirtualMemoryApi, buf, offset, count);
}

References count, DbgKdReadVirtualMemoryApi, and read_at().

Referenced by __read(), read_at_kernel_virtual(), rz_debug_winkd_attach(), and winkd_read_ver().

winkd_read_at_phys()

int winkd_read_at_phys	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_OUT ut8 *	buf,
		const int	count
	)

Definition at line 1370 of file winkd.c.

                                                                                                                                  {
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
    return read_at(ctx, DbgKdReadPhysicalMemoryApi, buf, offset, count);
}

References count, DbgKdReadPhysicalMemoryApi, and read_at().

Referenced by op_at_phys().

winkd_read_at_uva()

int winkd_read_at_uva	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_OUT ut8 *	buf,
		int	count
	)

Definition at line 596 of file winkd.c.

                                                                                                                        {
    return winkd_op_at_uva(ctx, address, buf, count, false);
}

References count, and winkd_op_at_uva().

Referenced by __read(), dmp_read(), read_at_uva_or_kernel(), winkd_get_target_base(), and winkd_list_modules().

winkd_read_ptr_at()

static ut64 winkd_read_ptr_at ( RZ_BORROW RZ_NONNULL WindCtx *  ctx, RZ_BORROW RZ_NONNULL WindReadAt *  read_at_func, ut64  at  )

inlinestatic

Definition at line 133 of file winkd.h.

                                                                                                                                {
    ut8 ptr_buf[8];
    if (!read_at_func(ctx->user, at, ptr_buf, ctx->is_64bit ? 8 : 4)) {
        return 0;
    }
    return ctx->is_64bit ? rz_read_le64(ptr_buf) : rz_read_le32(ptr_buf);
}

References rz_read_le32(), and rz_read_le64().

Referenced by get_current_process_and_thread(), rz_debug_dmp_attach(), rz_debug_dmp_init(), rz_debug_dmp_pids(), rz_debug_dmp_reg_read(), winkd_get_process_at(), winkd_list_process(), and winkd_walk_vadtree().

winkd_read_reg()

int winkd_read_reg	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		RZ_BORROW RZ_NONNULL RZ_OUT ut8 *	buf,
		int	size
	)

Definition at line 1231 of file winkd.c.

                                                                                                    {
    kd_req_t req = { 0 };
    kd_packet_t *pkt = NULL;
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
 
    if (ctx->context_cache_size >= size && ctx->context_cache_valid) {
        memcpy(buf, ctx->context_cache, size);
        return size;
    }
 
    req.req = DbgKdGetContextApi;
    req.cpu = ctx->cpu;
 
    req.rz_ctx.flags = 0x1003F;
 
    if (!winkd_send_state_manipulate_req(ctx, &req, NULL, 0, &pkt)) {
        return 0;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
    const size_t context_rq_sz = pkt->length - sizeof(kd_req_t);
    memcpy(buf, rr->data, RZ_MIN(size, context_rq_sz));
    free(pkt);
 
    if (context_rq_sz > ctx->context_cache_size || !ctx->context_cache) {
        void *tmp = realloc(ctx->context_cache, context_rq_sz);
        if (!tmp) {
            free(ctx->context_cache);
            ctx->context_cache = NULL;
            ctx->context_cache_size = 0;
            ctx->context_cache_valid = false;
            return 0;
        }
        ctx->context_cache = tmp;
        ctx->context_cache_size = context_rq_sz;
    }
    memcpy(ctx->context_cache, rr->data, context_rq_sz);
    ctx->context_cache_valid = true;
    ctx->context_cache_valid = context_rq_sz;
    return context_rq_sz;
}

References DbgKdGetContextApi, free(), memcpy(), NULL, PKT_REQ, realloc(), req, RZ_MIN, autogen_x86imm::tmp, and winkd_send_state_manipulate_req().

Referenced by rz_debug_winkd_reg_read().

winkd_read_ver()

bool winkd_read_ver

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 997 of file winkd.c.

                                                     {
    kd_req_t req = { 0 };
    kd_packet_t *pkt;
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return false;
    }
 
    req.req = 0x3146;
    req.cpu = ctx->cpu;
 
    if (!winkd_send_state_manipulate_req(ctx, &req, NULL, 0, &pkt)) {
        return false;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
 
    RZ_LOG_DEBUG("Major : %i Minor %i\n", rr->rz_ver.major, rr->rz_ver.minor);
    RZ_LOG_DEBUG("Protocol version : %i.%i\n", rr->rz_ver.proto_major, rr->rz_ver.proto_minor);
    RZ_LOG_DEBUG("Flags : %08x\n", rr->rz_ver.flags);
    RZ_LOG_DEBUG("Machine : %08x\n", rr->rz_ver.machine);
    RZ_LOG_DEBUG("Kernel Base : %016" PFMT64x "\n", rr->rz_ver.kernel_base);
    RZ_LOG_DEBUG("Module list : %016" PFMT64x "\n", rr->rz_ver.mod_addr);
    RZ_LOG_DEBUG("Debug block : %016" PFMT64x "\n", rr->rz_ver.dbg_addr);
 
    if (rr->rz_ver.machine != KD_MACH_I386 && rr->rz_ver.machine != KD_MACH_AMD64) {
        RZ_LOG_ERROR("Unsupported target host\n");
        free(pkt);
        return false;
    }
 
    if (!(rr->rz_ver.flags & DBGKD_VERS_FLAG_DATA)) {
        RZ_LOG_ERROR("No _KDDEBUGGER_DATA64 pointer has been supplied by the debugee!\n");
        free(pkt);
        return false;
    }
 
    ctx->kernel_module.addr = rr->rz_ver.kernel_base;
    ctx->windctx.is_64bit = rr->rz_ver.flags & DBGKD_VERS_FLAG_PTR64;
 
    ut64 ptr = 0;
    if (!winkd_read_at(ctx, rr->rz_ver.dbg_addr, (ut8 *)&ptr, 4 << ctx->windctx.is_64bit)) {
        free(pkt);
        return false;
    }
 
    ctx->windctx.PsLoadedModuleList = rr->rz_ver.mod_addr;
    ctx->windctx.KdDebuggerDataBlock = ptr;
 
    RZ_LOG_DEBUG("PsLoadedModuleList at 0x%016" PFMT64x "\n", ctx->windctx.PsLoadedModuleList);
    RZ_LOG_DEBUG("_KDDEBUGGER_DATA64 at 0x%016" PFMT64x "\n", ctx->windctx.KdDebuggerDataBlock);
 
    // Thanks to this we don't have to find a way to read the cr4
    ut16 pae_enabled;
    if (!winkd_read_at(ctx, ctx->windctx.KdDebuggerDataBlock + K_PaeEnabled, (ut8 *)&pae_enabled, sizeof(ut16))) {
        free(pkt);
        return false;
    }
 
    ctx->windctx.is_pae = pae_enabled & 1;
    ctx->windctx.profile = winkd_get_profile(32 << ctx->windctx.is_64bit, rr->rz_ver.minor, winkd_get_sp(&ctx->windctx));
    if (!ctx->windctx.profile) {
        RZ_LOG_WARN("Could not find a suitable profile for the target OS\n");
    }
    free(pkt);
    return true;
}

References DBGKD_VERS_FLAG_DATA, DBGKD_VERS_FLAG_PTR64, free(), K_PaeEnabled, KD_MACH_AMD64, KD_MACH_I386, NULL, PFMT64x, PKT_REQ, req, RZ_LOG_DEBUG, RZ_LOG_ERROR, RZ_LOG_WARN, ut64(), winkd_get_profile(), winkd_get_sp(), winkd_read_at(), and winkd_send_state_manipulate_req().

Referenced by rz_debug_winkd_attach().

winkd_set_cpu()

bool winkd_set_cpu	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		int	cpu
	)

Definition at line 91 of file winkd.c.

                                                             {
    if (!ctx || cpu > ctx->cpu_count) {
        return false;
    }
    ctx->cpu = cpu;
    return true;
}

References cpu.

Referenced by rz_debug_winkd_wait().

winkd_set_target()

bool winkd_set_target	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut32	pid,
		ut32	tid
	)

Definition at line 106 of file winkd.c.

                                                                             {
    WindProc *p;
    WindThread *t;
    RzList *l;
    RzListIter *it;
    const bool is_cur_process = ctx->target.eprocess && (ctx->target.uniqueid == pid);
    bool found = false;
    if (!is_cur_process) {
        l = winkd_list_process(ctx);
        rz_list_foreach (l, it, p) {
            if (p->uniqueid == pid) {
                found = true;
                ctx->target = *p;
                break;
            }
        }
        rz_list_free(l);
        if (!found) {
            ctx->target.eprocess = 0;
            ctx->target.uniqueid = 0;
            return false;
        }
    }
    const bool is_cur_thread = ctx->target_thread.ethread && (ctx->target_thread.uniqueid == tid);
    found = false;
    if (!is_cur_thread || !is_cur_process) {
        l = winkd_list_threads(ctx);
        if (is_cur_process) {
            rz_list_foreach (l, it, t) {
                if (t->uniqueid == tid) {
                    ctx->target_thread = *t;
                    found = true;
                    break;
                }
            }
        } else {
            t = rz_list_first(l);
            if (t) {
                ctx->target_thread = *t;
                found = true;
            }
        }
        rz_list_free(l);
        if (!found) {
            ctx->target_thread.ethread = 0;
            ctx->target_thread.uniqueid = 0;
            return false;
        }
    }
    return true;
}

References found, p, pid, rz_list_first(), rz_list_free(), WindThread::uniqueid, winkd_list_process(), and winkd_list_threads().

Referenced by rz_debug_dmp_select(), and rz_debug_winkd_select().

winkd_sync()

int winkd_sync

(

RZ_BORROW RZ_NONNULL KdCtx *

ctx

)

Definition at line 1065 of file winkd.c.

                                                {
    int ret = -1;
    kd_packet_t *s;
 
    if (!ctx || !ctx->desc) {
        return -1;
    }
 
    if (ctx->syncd) {
        return 0;
    }
 
    while (!winkd_lock_enter(ctx)) {
    };
 
    if (ctx->desc->iob->type == KD_IO_NET) {
        // Read a KD packet to initialize KDNet interface
        // The first packet will always be type of KD_PACKET_TYPE_UNUSED
        ret = kd_read_packet(ctx->desc, &s);
        if (ret != KD_E_OK) {
            goto end;
        }
    }
 
    // Send the breakin packet
    if (iob_write(ctx->desc, (const ut8 *)"b", 1) != 1) {
        ret = KD_E_IOERR;
        goto end;
    }
 
    if (ctx->desc->iob->type == KD_IO_PIPE) {
        // Reset the host
        ret = kd_send_ctrl_packet(ctx->desc, KD_PACKET_TYPE_RESET, 0);
        if (ret != KD_E_OK) {
            goto end;
        }
 
        // Wait for the response
        ret = winkd_wait_packet(ctx, KD_PACKET_TYPE_RESET, NULL);
        if (ret != KD_E_OK) {
            goto end;
        }
    }
    ctx->last_received_id = KD_INITIAL_PACKET_ID;
 
    // Syncronize with the first KD_PACKET_TYPE_STATE_CHANGE64 packet
    ret = winkd_wait_packet(ctx, KD_PACKET_TYPE_STATE_CHANGE64, &s);
    if (ret != KD_E_OK) {
        goto end;
    }
 
    // Reset the sequence id
    ctx->seq_id = KD_INITIAL_PACKET_ID;
 
    kd_stc_64 *stc64 = PKT_STC(s);
    ctx->cpu = stc64->cpu;
    ctx->cpu_count = stc64->cpu_count;
    ctx->windctx.target.eprocess = 0;
    rz_list_free(ctx->plist_cache);
    ctx->plist_cache = NULL;
    rz_list_free(ctx->tlist_cache);
    ctx->tlist_cache = NULL;
    ctx->windctx.is_pae = 0;
    ctx->windctx.target_thread.ethread = stc64->kthread;
    // We're ready to go
    ctx->syncd = 1;
 
    free(s);
    RZ_LOG_INFO("Sync done! (%i cpus found)\n", ctx->cpu_count);
    ret = 1;
 
end:
    winkd_lock_leave(ctx);
    return ret;
}

References test_evm::end, free(), iob_write(), KD_E_IOERR, KD_E_OK, KD_INITIAL_PACKET_ID, KD_IO_NET, KD_IO_PIPE, KD_PACKET_TYPE_RESET, KD_PACKET_TYPE_STATE_CHANGE64, kd_read_packet(), kd_send_ctrl_packet(), NULL, PKT_STC, rz_list_free(), RZ_LOG_INFO, s, winkd_lock_enter(), winkd_lock_leave(), and winkd_wait_packet().

Referenced by rz_debug_winkd_attach().

winkd_va_to_pa()

bool winkd_va_to_pa	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut64	directory_table,
		ut64	va,
		RZ_BORROW RZ_NONNULL RZ_OUT ut64 *	pa
	)

Definition at line 860 of file winkd.c.

                                                                                                                            {
    ut64 pml4i, pdpi, pdi, pti;
    ut64 tmp, mask;
 
    if (ctx->is_64bit) {
        pti = (va >> 12) & 0x1ff;
        pdi = (va >> 21) & 0x1ff;
        pdpi = (va >> 30) & 0x1ff;
        pml4i = (va >> 39) & 0x1ff;
        // Grab the PageFrameNumber field off the _HARDWARE_PTE entry
        mask = 0x000000fffffff000;
    } else {
        if (ctx->is_pae) {
            pti = (va >> 12) & 0x1ff;
            pdi = (va >> 21) & 0x1ff;
            pdpi = (va >> 30) & 0x3;
            pml4i = 0;
        } else {
            pti = (va >> 12) & 0x3ff;
            pdi = (va >> 22) & 0x3ff;
            pdpi = 0;
            pml4i = 0;
        }
        // Grab the PageFrameNumber field off the _HARDWARE_PTE entry
        mask = 0xfffff000;
    }
 
    tmp = directory_table;
    tmp &= ~0x1f;
 
    if (ctx->is_64bit) {
        // PML4 lookup
        if (!ctx->read_at_physical(ctx->user, tmp + pml4i * 8, (ut8 *)&tmp, 8)) {
            return false;
        }
        tmp &= mask;
    }
 
    if (ctx->is_pae) {
        // PDPT lookup
        if (!ctx->read_at_physical(ctx->user, tmp + pdpi * 8, (ut8 *)&tmp, 8)) {
            return false;
        }
        tmp &= mask;
    }
 
    const int read_size = ctx->is_pae ? 8 : 4;
 
    // PDT lookup
    if (!ctx->read_at_physical(ctx->user, tmp + pdi * read_size, (ut8 *)&tmp, read_size)) {
        return false;
    }
 
    // Large page entry
    // The page size differs between pae and non-pae systems, the former points to 2MB pages while
    // the latter points to 4MB pages
    if (is_page_large(ctx, tmp)) {
        tmp = (tmp << 16) >> 16;
        *pa = ctx->is_pae ? (tmp & (~0x1fffff)) | (va & 0x1fffff) : (tmp & (~0x3fffff)) | (va & 0x3fffff);
        return true;
    }
 
    // PT lookup
    if (!ctx->read_at_physical(ctx->user, (tmp & mask) + pti * read_size, (ut8 *)&tmp, read_size)) {
        return false;
    }
 
    if (tmp & PTE_VALID) {
        *pa = (tmp & mask) | (va & 0xfff);
        return true;
    }
 
    if (tmp & PTE_PROTOTYPE) {
        // TODO : prototype PTE support
        RZ_LOG_ERROR("Prototype PTE lookup is currently missing!\n");
    }
 
    return false;
}

References is_page_large(), mask, PTE_PROTOTYPE, PTE_VALID, RZ_LOG_ERROR, autogen_x86imm::tmp, and ut64().

Referenced by winkd_op_at_uva().

winkd_wait_packet()

int winkd_wait_packet	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut32	type,
		RZ_NULLABLE RZ_OUT kd_packet_t **	p
	)

Definition at line 258 of file winkd.c.

                                                                                                            {
    kd_packet_t *pkt = NULL;
    int ret;
    if (p) {
        *p = NULL;
    }
 
    bool is_repeated_packet;
    do {
        free(pkt);
        // Try to read a whole packet
        ret = kd_read_packet(ctx->desc, &pkt);
        if (ret != KD_E_OK) {
            return ret;
        }
        RZ_LOG_DEBUG("=== Received Packet ===\n");
        RZ_LOG_DEBUG("PACKET ID : 0x%x\n", pkt->id);
        is_repeated_packet = ctx->last_received_id == pkt->id;
        if (is_repeated_packet) {
            RZ_LOG_DEBUG("Repeated packet, skipping\n");
        } else if (pkt->leader == KD_PACKET_DATA) {
            ctx->last_received_id = pkt->id;
        }
        if (pkt->type == KD_PACKET_TYPE_UNUSED) {
            is_repeated_packet = true;
            continue;
        }
    } while (is_repeated_packet);
 
    if (pkt->type != type) {
        RZ_LOG_DEBUG("We were not waiting for this: %02x Expected: %02x\n", pkt->type, type);
    }
    if (pkt->leader == KD_PACKET_DATA && pkt->type == KD_PACKET_TYPE_STATE_CHANGE64) {
        RZ_LOG_VERBOSE("Got STATE_CHANGE64 packet\n");
        kd_stc_64 *stc = PKT_STC(pkt);
        if (stc->state == DbgKdExceptionStateChange) {
            RZ_LOG_VERBOSE("    Exception\n");
            RZ_LOG_VERBOSE("        Code   : %08" PFMT32x "\n", stc->exception.code);
            RZ_LOG_VERBOSE("        Flags  : %08" PFMT32x "\n", stc->exception.flags);
            RZ_LOG_VERBOSE("        Record : %016" PFMT64x "\n", stc->exception.ex_record);
            RZ_LOG_VERBOSE("        Addr   : %016" PFMT64x "\n", stc->exception.ex_addr);
            if (ctx->breaked) {
                RZ_LOG_VERBOSE("    BREAKED\n");
            }
        } else if (stc->state == DbgKdLoadSymbolsStateChange) {
            RZ_LOG_VERBOSE(stc->load_symbols.unload ? "    Unload Symbols\n" : "    Load Symbols\n");
            RZ_LOG_VERBOSE("        Path Size : %016" PFMT64x "\n", stc->load_symbols.pathsize);
            RZ_LOG_VERBOSE("        Base      : %016" PFMT64x "\n", stc->load_symbols.base);
            RZ_LOG_VERBOSE("        Checksum  : %08" PFMT32x "\n", stc->load_symbols.checksum);
            RZ_LOG_VERBOSE("        ImageSize : %08" PFMT32x "\n", stc->load_symbols.size);
            if (load_symbol_path_is_valid(pkt)) {
                char *path = (char *)pkt->data + pkt->length - stc->load_symbols.pathsize;
                path[stc->load_symbols.pathsize - 1] = 0;
                RZ_LOG_VERBOSE("        Image     : %s\n", path);
                if (rz_str_endswith(path, "\\ntoskrnl.exe")) {
                    ctx->kernel_module.addr = stc->load_symbols.base;
                    ctx->kernel_module.size = stc->load_symbols.size;
                    ctx->kernel_module.name = strdup(path);
                }
            }
        } else if (stc->state == DbgKdCommandStringStateChange) {
            RZ_LOG_VERBOSE("CommandString\n");
        } else {
            RZ_LOG_WARN("Unknown state change packet type: 0x%" PFMT32x "\n", (ut32)pkt->type);
        }
    } else if (pkt->leader == KD_PACKET_DATA && pkt->type == KD_PACKET_TYPE_FILE_IO) {
        RZ_LOG_DEBUG("File IO\n");
        RZ_LOG_DEBUG("  req: %08" PFMT32x "\n", PKT_IO(pkt)->req);
        RZ_LOG_DEBUG("  ret: %08" PFMT32x "\n", PKT_IO(pkt)->ret);
        RZ_LOG_DEBUG("Replying IO\n");
        do_io_reply(ctx, pkt);
    } else if (pkt->leader == KD_PACKET_DATA && pkt->type == KD_PACKET_TYPE_STATE_MANIPULATE) {
        RZ_LOG_DEBUG("State_manipulate\n");
        RZ_LOG_DEBUG("  req: %08" PFMT32x "\n", PKT_REQ(pkt)->req);
        RZ_LOG_DEBUG("  cpu_level: %08x\n", PKT_REQ(pkt)->cpu_level);
        RZ_LOG_DEBUG("  cpu: %i\n", PKT_REQ(pkt)->cpu);
        RZ_LOG_DEBUG("  ret: %08" PFMT32x "\n", PKT_REQ(pkt)->ret);
    }
 
    if (pkt->leader == KD_PACKET_CTRL) {
        switch (pkt->type) {
        case KD_PACKET_TYPE_ACKNOWLEDGE:
            RZ_LOG_DEBUG("ACK received\n");
            if (pkt->id == ctx->seq_id) {
                ctx->seq_id ^= 1;
            }
            if (type == KD_PACKET_TYPE_ACKNOWLEDGE) {
                free(pkt);
                return KD_E_OK;
            }
            break;
        case KD_PACKET_TYPE_RESET:
            RZ_LOG_DEBUG("Reset received\n");
            ctx->seq_id = KD_INITIAL_PACKET_ID;
            ctx->last_received_id = KD_INITIAL_PACKET_ID;
            free(pkt);
            if (type == KD_PACKET_TYPE_RESET) {
                return KD_E_OK;
            }
            return KD_E_MALFORMED;
        case KD_PACKET_TYPE_RESEND:
            // The host didn't like our request
            rz_sys_backtrace();
            RZ_LOG_DEBUG("Waoh. You probably sent a malformed packet!\n");
            free(pkt);
            return KD_E_MALFORMED;
        }
    }
    if (pkt->type != type) {
        free(pkt);
        if (ctx->breaked) {
            ctx->breaked = false;
            return KD_E_BREAK;
        } else {
            return KD_E_MALFORMED;
        }
    }
    ctx->breaked = false;
    if (ret != KD_E_OK) {
        free(pkt);
        return ret;
    }
 
    if (p) {
        *p = pkt;
    } else {
        free(pkt);
    }
 
    return KD_E_OK;
}

References cpu, DbgKdCommandStringStateChange, DbgKdExceptionStateChange, DbgKdLoadSymbolsStateChange, do_io_reply(), free(), KD_E_BREAK, KD_E_MALFORMED, KD_E_OK, KD_INITIAL_PACKET_ID, KD_PACKET_CTRL, KD_PACKET_DATA, KD_PACKET_TYPE_ACKNOWLEDGE, KD_PACKET_TYPE_FILE_IO, KD_PACKET_TYPE_RESEND, KD_PACKET_TYPE_RESET, KD_PACKET_TYPE_STATE_CHANGE64, KD_PACKET_TYPE_STATE_MANIPULATE, KD_PACKET_TYPE_UNUSED, kd_read_packet(), load_symbol_path_is_valid(), NULL, p, path, PFMT32x, PFMT64x, PKT_IO, PKT_REQ, PKT_STC, req, RZ_LOG_DEBUG, RZ_LOG_VERBOSE, RZ_LOG_WARN, rz_str_endswith(), rz_sys_backtrace(), strdup(), and type.

Referenced by do_io_reply(), rz_debug_winkd_wait(), winkd_continue(), winkd_send_state_manipulate_req(), and winkd_sync().

winkd_windmodule_free()

void winkd_windmodule_free

(

void *

ptr

)

Definition at line 611 of file winkd.c.

                                      {
    WindModule *mod = ptr;
    free(mod->name);
    free(mod);
}

References free(), and mod().

Referenced by dmp_get_modules(), and winkd_list_modules().

winkd_write_at()

int winkd_write_at	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_IN const ut8 *	buf,
		const int	count
	)

Definition at line 1384 of file winkd.c.

                                                                                                                                   {
    kd_packet_t *pkt = NULL;
    kd_req_t req = { 0 };
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
 
    int payload = RZ_MIN(count, KD_MAX_PAYLOAD - sizeof(kd_req_t));
    req.req = DbgKdWriteVirtualMemoryApi;
    req.cpu = ctx->cpu;
    req.rz_mem.addr = offset;
    req.rz_mem.length = payload;
 
    if (!winkd_send_state_manipulate_req(ctx, &req, buf, payload, &pkt)) {
        return 0;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
    int ret = rr->rz_mem.read;
    free(pkt);
    return ret;
}

References count, DbgKdWriteVirtualMemoryApi, free(), KD_MAX_PAYLOAD, NULL, PKT_REQ, req, RZ_MIN, and winkd_send_state_manipulate_req().

Referenced by __write().

winkd_write_at_phys()

int winkd_write_at_phys	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		const ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_IN const ut8 *	buf,
		const int	count
	)

Definition at line 1408 of file winkd.c.

                                                                                                                                        {
    kd_packet_t *pkt;
    kd_req_t req = { 0 };
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return 0;
    }
 
    int payload = RZ_MIN(count, KD_MAX_PAYLOAD - sizeof(kd_req_t));
 
    memset(&req, 0, sizeof(kd_req_t));
 
    req.req = DbgKdWritePhysicalMemoryApi;
    req.cpu = ctx->cpu;
 
    req.rz_mem.addr = offset;
    req.rz_mem.length = payload;
    req.rz_mem.read = 0; // Default caching option
 
    if (!winkd_send_state_manipulate_req(ctx, &req, buf, payload, &pkt)) {
        return 0;
    }
 
    kd_req_t *rr = PKT_REQ(pkt);
 
    if (rr->ret) {
        free(pkt);
        return 0;
    }
    int ret = rr->rz_mem.read;
    free(pkt);
    return ret;
}

References count, DbgKdWritePhysicalMemoryApi, free(), KD_MAX_PAYLOAD, memset(), PKT_REQ, req, RZ_MIN, and winkd_send_state_manipulate_req().

Referenced by op_at_phys().

winkd_write_at_uva()

int winkd_write_at_uva	(	RZ_BORROW RZ_NONNULL WindCtx *	ctx,
		ut64	offset,
		RZ_BORROW RZ_NONNULL RZ_IN const ut8 *	buf,
		int	count
	)

Definition at line 600 of file winkd.c.

                                                                                                                              {
    return winkd_op_at_uva(ctx, address, (ut8 *)buf, count, true);
}

References count, and winkd_op_at_uva().

Referenced by __write(), and dmp_write().

winkd_write_reg()

bool winkd_write_reg	(	RZ_BORROW RZ_NONNULL KdCtx *	ctx,
		ut32	flags,
		RZ_BORROW RZ_NONNULL RZ_IN const ut8 *	buf,
		int	size
	)

Definition at line 1179 of file winkd.c.

                                                                                                                       {
    kd_packet_t *pkt = NULL;
    kd_req_t req = { 0 };
 
    if (!ctx || !ctx->desc || !ctx->syncd) {
        return false;
    }
    const ut64 max_ctx_size = KD_MAX_PAYLOAD - sizeof(kd_req_t);
    RZ_LOG_DEBUG("Regwrite() size: %x\n", size);
    if (size > max_ctx_size) {
        ut32 offset = 0;
        ut32 left = size;
        req.req = DbgKdSetContextEx;
        req.cpu = ctx->cpu;
        req.rz_ctx_ex.copied = size;
        do {
            const ut64 rest = RZ_MIN(left, max_ctx_size);
            req.rz_ctx_ex.count = rest;
            req.rz_ctx_ex.offset = offset;
            RZ_FREE(pkt);
            if (!winkd_send_state_manipulate_req(ctx, &req, buf + offset, rest, &pkt)) {
                break;
            }
            if (PKT_REQ(pkt)->rz_ctx_ex.count > left) {
                offset = size;
                break;
            }
            left -= PKT_REQ(pkt)->rz_ctx_ex.count;
            offset += PKT_REQ(pkt)->rz_ctx_ex.count;
        } while (left);
        size = offset;
    } else {
        req.req = DbgKdSetContextApi;
        req.cpu = ctx->cpu;
        req.rz_ctx.flags = flags;
        if (!winkd_send_state_manipulate_req(ctx, &req, buf, size, &pkt)) {
            return false;
        }
    }
 
    if (size > ctx->context_cache_size) {
        free(ctx->context_cache);
        ctx->context_cache = malloc(size);
        ctx->context_cache_size = size;
    }
 
    memcpy(ctx->context_cache, buf, size);
 
    free(pkt);
    return size;
}

References DbgKdSetContextApi, DbgKdSetContextEx, flags, free(), KD_MAX_PAYLOAD, malloc(), memcpy(), NULL, PKT_REQ, req, RZ_FREE, RZ_LOG_DEBUG, RZ_MIN, ut64(), and winkd_send_state_manipulate_req().

Referenced by rz_debug_winkd_reg_write().